Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-g663-4qpc-m3gp
Summary
Improper file handling in matrix-react-sdk
Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
Aliases
0
alias CVE-2021-32622
1
alias GHSA-cg57-p69r-3m7p
Fixed_packages
0
url pkg:npm/matrix-react-sdk@3.21.0
purl pkg:npm/matrix-react-sdk@3.21.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1g1f-1x88-tbg5
1
vulnerability VCID-3s7z-6bqr-rqd1
2
vulnerability VCID-e42f-h16f-gkbf
3
vulnerability VCID-k3ft-j7d1-nkh7
4
vulnerability VCID-ybpz-t956-k7fb
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.21.0
Affected_packages
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-32622
reference_id
reference_type
scores
0
value 0.00174
scoring_system epss
scoring_elements 0.3876
published_at 2026-04-21T12:55:00Z
1
value 0.00174
scoring_system epss
scoring_elements 0.38875
published_at 2026-04-04T12:55:00Z
2
value 0.00174
scoring_system epss
scoring_elements 0.38805
published_at 2026-04-07T12:55:00Z
3
value 0.00174
scoring_system epss
scoring_elements 0.38857
published_at 2026-04-08T12:55:00Z
4
value 0.00174
scoring_system epss
scoring_elements 0.38868
published_at 2026-04-09T12:55:00Z
5
value 0.00174
scoring_system epss
scoring_elements 0.38881
published_at 2026-04-11T12:55:00Z
6
value 0.00174
scoring_system epss
scoring_elements 0.38844
published_at 2026-04-12T12:55:00Z
7
value 0.00174
scoring_system epss
scoring_elements 0.38816
published_at 2026-04-13T12:55:00Z
8
value 0.00174
scoring_system epss
scoring_elements 0.38862
published_at 2026-04-16T12:55:00Z
9
value 0.00174
scoring_system epss
scoring_elements 0.3884
published_at 2026-04-18T12:55:00Z
10
value 0.00174
scoring_system epss
scoring_elements 0.38717
published_at 2026-04-01T12:55:00Z
11
value 0.00174
scoring_system epss
scoring_elements 0.38854
published_at 2026-04-02T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-32622
1
reference_url https://github.com/matrix-org/matrix-react-sdk/pull/5981
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/matrix-org/matrix-react-sdk/pull/5981
2
reference_url https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-32622
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-32622
4
reference_url https://www.npmjs.com/package/matrix-react-sdk
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.npmjs.com/package/matrix-react-sdk
5
reference_url https://github.com/advisories/GHSA-cg57-p69r-3m7p
reference_id GHSA-cg57-p69r-3m7p
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-cg57-p69r-3m7p
Weaknesses
0
cwe_id 434
name Unrestricted Upload of File with Dangerous Type
description The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
1
cwe_id 74
name Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Exploits
Severity_range_score4.0 - 6.9
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-g663-4qpc-m3gp